upgrading to 11g

86
Oracle DB 11g Overview Upgrading to 11g – What That Means to You? Virtual Classroom Steve Flournoy OD Solutions Specialist

Upload: oracleonthebrain

Post on 17-May-2015

4.225 views

Category:

Technology


2 download

TRANSCRIPT

Page 1: Upgrading To 11g

Oracle DB 11g Overview Upgrading to 11g – What That Means to You?Virtual ClassroomSteve FlournoyOD Solutions Specialist

Page 2: Upgrading To 11g

Oracle Database 11g Release 2

Specific Areas of Cost Reduction

• Reduce hardware costs by factor of 5x

• Reduce storage costs by factor of 12x

• Improve performance by at least 10x

• Eliminate downtime AND unused redundancy• Eliminate downtime AND unused redundancy

• Raise DBA productivity by at least 2x

• Considerably simplify your software portfolio

• Reduce upgrade costs by a factor of 4x

© 2009 Oracle Corporation – Proprietary and Confidential

Page 3: Upgrading To 11g

Lifetime Support PolicyFeature Premier

SupportExtended Support

Sustaining Support

Major Product and Technology ReleasesMajor Product and Technology Releases �������� �������� ��������

Technical SupportTechnical Support �������� �������� ��������

Access to Knowledge BaseAccess to Knowledge Base

(MetaLink/Customer (MetaLink/Customer Connection/SupportWeb)Connection/SupportWeb)

�������� �������� ��������

Updates, Fixes, Security Alerts and Critical Updates, Fixes, Security Alerts and Critical Patch UpdatesPatch Updates

�������� �������� PrePre--existing existing OnlyOnlyPatch UpdatesPatch Updates OnlyOnly

Tax, Legal and Regulatory UpdatesTax, Legal and Regulatory Updates �������� �������� NoNo

Upgrade ScriptsUpgrade Scripts �������� �������� NoNo

Certification with existing Third Party Certification with existing Third Party Products/VersionsProducts/Versions

�������� �������� NoNo

Certification with New Third Party Certification with New Third Party Products/VersionsProducts/Versions

�������� NoNo NoNo

Certification with new Oracle ProductsCertification with new Oracle Products �������� �������� NoNo

Page 4: Upgrading To 11g

today

Lifetime Support Policy

R2 July 2010 July 2013

August 2012 August 2015

July 2011

t

2008

2003

2004

2005

2006

2007

2002

2009

2010

2011

2012

2013

2014

Sustaining Support

Premier Support

R2 July 2007

Extended SupportJuly 2010

January 2009 January 2012

http://www.oracle.com/support/library/brochure/lifetime-support-technology.pdf

2015

2016

July 2008

Page 5: Upgrading To 11g

Upgrade to Oracle Database 11g

R2R2

≥≥≥≥ 7.3.47.3.47.3.47.3.4≥≥≥≥ 7.3.47.3.47.3.47.3.4

≥≥≥≥ 9.2.0.49.2.0.49.2.0.49.2.0.4≥≥≥≥ 9.2.0.49.2.0.49.2.0.49.2.0.4

≥≥≥≥ 8.0.68.0.68.0.68.0.6≥≥≥≥ 8.0.68.0.68.0.68.0.6

≥≥≥≥ 8.1.7.48.1.7.48.1.7.48.1.7.4≥≥≥≥ 8.1.7.48.1.7.48.1.7.48.1.7.4

≥≥≥≥ 9.0.1.49.0.1.49.0.1.49.0.1.4≥≥≥≥ 9.0.1.49.0.1.49.0.1.49.0.1.4

R2R2

Page 6: Upgrading To 11g

AgendaOracle 11g Overview• Manageability & Testing

• Real Application Testing

• Grid Computing / High Availability

• Active DG

• Online Application Upgrade

• RAC (New Features)

• Performance / Storage Management

• Advance Compression• Advance Compression

• Partitioning

• In-Memory Cache

• ASM Cluster File System

• Database Security

• Monitoring

• Access Control

• Encryption & Masking

Page 7: Upgrading To 11g

AgendaOracle 11g Overview• Manageability & Testing

• Real Application Testing

• Grid Computing / High Availability

• Active DG

• Online Application Upgrade

• RAC (New Features)

• Performance / Storage Management

• Advance Compression• Advance Compression

• Partitioning

• In-Memory Cache

• ASM Cluster File System

• Database Security

• Monitoring

• Access Control

• Encryption & Masking

Page 8: Upgrading To 11g

Real Application Testing Option Reduces the time required to test changesReduces the time required to test changes

Page 9: Upgrading To 11g

Real Application Testing Delivers Adaptive Change Assurance

TestTestTestTest

DeployDeploy

• Reduces risk of new technology adoption through higher testing quality

• Reduces time for

Change

RemediateRemediate

• Reduces time for effective testing from weeks to days

Solution for the Agile Business

Page 10: Upgrading To 11g

RAT: From Manual to Automated

1 2 3 4 5

Typical Steps in Test Phase

Page 11: Upgrading To 11g

Real Application Testing

SQL

PERFORMANCE

ANALYZER

DATABASE

REPLAY

Page 12: Upgrading To 11g

• Measure and report on performance before and after a change

Great For• Database upgrades including patch deployments• Database Initialization Parameter Changes

Real Application Testing with SQL Performance Analyzer (SPA)

• Database Initialization Parameter Changes

• Schema Changes

• Optimizer Statistics Refresh• Changes to the OS & HW • Implementing Tuning Recommendations

Page 13: Upgrading To 11g

ClientClient

…Client

• Test impact of change on SQL query performance

• Capture SQL workload in production including statistics & bind variables

• Re-execute SQL queries in test environment

• Tune regressed SQL and seed SQL plans for production

Production Test

Real Application Testing with SQL Performance Analyzer (SPA)

……

Capture SQL

Middle Tier

Storage

Oracle DB

Re-execute SQL Queries

Production Test

Use SQL Tuning Advisor to tune regression

Page 14: Upgrading To 11g

SQL Performance Analyzer Workflow

Initial Environment

Make Change

Post-Change Environment

Tune SQL

Tuned Environment

Compare Performance

Execute Production SQL and Gather Stats

Re-execute SQL

SQL Tuning Advisor

Execute SQL

Page 15: Upgrading To 11g

SQL Performance Analyzer Typical Configuration

Page 16: Upgrading To 11g

SQL Performance AnalyzerTask Result

Page 17: Upgrading To 11g

Testing a Database Upgrade

Page 18: Upgrading To 11g

Testing a Database Upgrade

Page 19: Upgrading To 11g

ClientClient

…Client

Real Application Testing with Database Replay

• Recreate actual production database workload in test environment

• Capture workload in production including critical concurrency

• Replay workload in test with production timing

• Analyze & fix issues before production

Production Test

……

Capture DB Workload

Middle Tier

Storage

Oracle DB

Replay DB Workload

Production Test

Test migration to RAC

Page 20: Upgrading To 11g

Database Replay: Supported Changes

Changes Unsupported

Changes Supported

ClientClient

…Client

Middle Tier

Changes Supported

•Database Upgrades, Patches

•Schema, Parameters

•RAC nodes, Interconnect

•OS Platforms, OS Upgrades

•CPU, Memory

•Storage

•Etc.

Storage

Recording of External Client

Requests

Page 21: Upgrading To 11g

Database Replay Diagram

Page 22: Upgrading To 11g
Page 23: Upgrading To 11g

DB Replay ReportsUsers can generate reports during or at the end of replay

Page 24: Upgrading To 11g

AgendaOracle 11g Overview• Manageability & Testing

• Real Application Testing

• Grid Computing / High Availability

• Active DG

• Online Application Upgrade

• RAC (New Features)

• Performance / Storage Management

• Advance Compression• Advance Compression

• Partitioning

• In-Memory Cache

• ASM Cluster File System

• Database Security

• Monitoring

• Access Control

• Encryption & Masking

Page 25: Upgrading To 11g

Active Data Guard Active Data Guard Saving on storage costs and increasing performance

Page 26: Upgrading To 11g

Oracle Active Data Guard 11g

Increase performance and utilization

• Physical standbys:

• Most popular type of standby database

• Simple, fast, supports all data types and applications

• In Data Guard 10g

• Can be open read-only, but Redo Apply has to stop

• Latest data is not available for query or reports

• Also prolongs switchover / failover

• Oracle Active Data Guard 11g – a new Database Option

• Real-time Query enables read-only access to a physical standby database while Redo Apply is active

Page 27: Upgrading To 11g

Active Data Guard Real-time Query

Primary

Continuous Redo Shipment and Apply

Concurrent Real-Time Query

Physical Standby

Database

Primary

Database

• Read-only queries on physical standby concurrent with redo apply

• Supports RAC on primary and/or standby

• Queries see transactionally consistent results

• Handles all data types, but not as flexible as logical standby

Page 28: Upgrading To 11g

Updates

Primary

Queries

Physical Standby

Snapshot StandbyLeverage Standby Database for Testing

Snapshot Standby

UpdatesQueries

Physical Standby Primary

DatabasePhysical Standby

DatabaseSnapshot Standby

Database

Physical Standby

Database

• Preserves zero data loss – continuous redo transport while open read-write

• Truly leverages standby database and DR hardware for multiple purposes

• Similar to storage snapshots, but provides DR at the same time and uses single copy of storage

Page 29: Upgrading To 11g

Online Application Upgrade Online Application Upgrade Application Upgrade can now be performed online

Page 30: Upgrading To 11g

Online Application UpgradeEdition-based redefinition

• Code changes are installed in the privacy of a new edition

• Data changes are made safely by writing only to new columns or new tables not seen by the old edition

• An editioning view exposes a different projection of a • An editioning view exposes a different projection of a table into each edition to allow each to see just its own columns

• A crossedition trigger propagates data changes made by the old edition into the new edition’s columns, or (in hot-rollover) vice-versa

Page 31: Upgrading To 11g

Oracle Real Application Clusters Oracle Real Application Clusters RAC provides fault tolerance, performance, and scalability

Page 32: Upgrading To 11g

Real Application ClustersVirtualizes server resources

HR SALES ERP

• Runs all Oracle database applications

• Highly available and scalable

• Adapts to changes in workloads

© 2009 Oracle Corporation – Proprietary and Confidential

Page 33: Upgrading To 11g

Oracle Database 11g Release 2Dynamic Cluster Partitioning via

Server Pools

Back Office Front Office Depart/LOB Free

• Dynamically assigns servers to run groups of related workload

• Allocation is Policy Managed – Min/Max, Relative Importance

• Unassigned Servers go to Free Pool

• Cluster reconfigures if a pool falls below its minimums

Page 34: Upgrading To 11g

Database Diagnostic Pack with RAC

Self-Diagnostic Engine

Database-Level ADDM

11g

• “Plain English” performance expert in a box

• Identify the most “Globally Significant”performance problems for the entire RAC cluster database

• Database-wide analysis of:

AWR 1 AWR 2 AWR 3

Inst 1 Inst 2 Inst 3

of:

• Global cache interconnect issues

• Global resource contention, e.g. IO bandwidth, hot blocks

• Globally high-load SQL

• Skew in instance response times

Instance-Level ADDM

Page 35: Upgrading To 11g

AgendaOracle 11g Overview• Manageability & Testing

• Real Application Testing

• Grid Computing / High Availability

• Active DG

• Online Application Upgrade

• RAC (New Features)

• Performance / Storage Management

• Advance Compression• Advance Compression

• Partitioning

• In-Memory Cache

• ASM Cluster File System

• Database Security

• Monitoring

• Access Control

• Encryption & Masking

Page 36: Upgrading To 11g

Advanced Compression Option Advanced Compression Option Saving on storage costs and increasing performance

Page 37: Upgrading To 11g

Oracle Advanced Compression Option

Relational Data Compression

Unstructured Data

Backup Data Compression

Network Data Compression

• OLTP Table Compression

• SecureFiles Deduplication

• SecureFiles Compression

• Data Pump Data Compression

• RMAN Fast Backup Compression

• Data Guard Redo Transport Compression

• Reduces resource requirements and costs • Storage System

• Network Bandwidth

• Memory Usage

CompressionData

CompressionCompression Compression

Page 38: Upgrading To 11g

Oracle Advanced Compression Option

Page 39: Upgrading To 11g

Oracle Advanced Compression Option

Page 40: Upgrading To 11g

Oracle Advanced Compression Option

Relational Data Compression

Unstructured Data

Backup Data Compression

Network Data Compression

• OLTP Table Compression

• SecureFiles Deduplication

• SecureFiles Compression

• Data Pump Data Compression

• RMAN Fast Backup Compression

• Data Guard Redo Transport Compression

• Reduces resource requirements and costs • Storage System

• Network Bandwidth

• Memory Usage

CompressionData

CompressionCompression Compression

Page 41: Upgrading To 11g

New Features in Oracle Database 11g

• Data Recovery Advisor

• Multisection Backups

• Fast Backup Compression

• Network-enabled Database Duplication.• Network-enabled Database Duplication.

• Virtual Private Catalog

• Integration with Windows Volume Shadow Copy Services (VSS)

Page 42: Upgrading To 11g

Real World Compression Results10 Largest ERP Database Tables

1000

1500

2000

2500Data Storage

Table Scans0.4

0

500

3x Saving

0

0.1

0.2

0.3

2.5x Faster

DML Performance

0

10

20

30

40

< 3% Overhead

Page 43: Upgrading To 11g

Oracle Database 11g Compression Advisor

• Analyzes objects to give estimate of space savings for different compression methods

• Helps in deciding correct compression level for application

• Recommends various strategies for compression• Picking the right compression algorithm for a particular data set

• Sorting on a particular column for increasing compression ratio

• Presents tradeoffs between different compression algorithms

• DBMS_COMPRESSION package (11g R2)

• Provides tools for estimating compressibility of a table

© 2009 Oracle Corporation – Proprietary and Confidential

Page 44: Upgrading To 11g

Partitioning Option Allows database tables and indexes to be divided into Allows database tables and indexes to be divided into

smaller, more manageable parts

Page 45: Upgrading To 11g

Oracle Partitioning10 years of innovation

Core functionality

Oracle8 Range partitions, global range index

Oracle8i Hash and composite range-hash partitioning

Oracle9i List partitioning

Oracle9i R2 Composite range-list partitioning

Oracle 10g Global hash indexes

Oracle 10gR2

1M partitions per tablePartitioning by referenceVirtual column partitioningAutomatic interval partitioningNew composite partitioning:

range-range, list-range,list-list, list-hash

Page 46: Upgrading To 11g

Partitioning in Oracle Database 11g Advice, Ease, even more Business-driven designs

ORDERS ORDERS

Jan Feb

>5000

<4999

ORDERS

Jan Feb

Partition Advisor

Business-driven Composite Partitioning

Jan Feb

Automatic Interval, and Reference Partitioning

Jan Feb

Page 47: Upgrading To 11g

Partitioning in Oracle Database 11g Advice, Ease, even more Business-driven designs

ORDERS ORDERS

Jan Feb

>5000

<4999

ORDERS

Jan Feb

Partition Advisor

Business-driven Composite Partitioning

Jan Feb

Automatic Interval, and Reference Partitioning

Jan Feb

Page 48: Upgrading To 11g

ORDERS TABLE (7 years)

2003

Manage Data Growth Partition for performance, management

and cost

20092008

5% Active5% Active95% Less Active95% Less Active

High End Storage Tier Low End Storage Tier 2-3x less per terabyte

Page 49: Upgrading To 11g

Partitioning and Advanced CompressionBetter Together – Simple Savings You Can Count On

Partitioning

ORDERS(2 TB @ $72* & 8 TB @ $14*)

Savings = $464,000

2009

Europe

USA

2008 2007 2006 2005

Over 85% Storage

ORDERS (10 TB @ $72*)Single Large Table

Cost = $720,000

ORDERS(3.3 TB @ $72*)

Savings - $482,400

Compression3 to 1

Compression3 to 1

Partitioning

ORDERS(.7 TB @ $72* & 2.7 TB @ $14*)

Combined Savings = $631,800

2009

Europe

USA

2008 2007 2006 2005

Storage Savings

Note: * - $ per GB of storage

Page 50: Upgrading To 11g

Oracle ILM Assistant

• Oracle ILM Assistant Manages the ILM environment

• Define Lifecycle Definitions• Define Lifecycle Definitions

• Illustrates Storage Costs & Savings

• Manage Compliance & Security

• Calendar of Events

• Simulates the impact of partitioning on a table

• Advises how to • Partition a Table

• Generates Scripts to move data when required

Page 51: Upgrading To 11g

Oracle ILM AssistantLifecycle Definition

Page 52: Upgrading To 11g

Oracle ILM AssistantCost Savings By Storage Tier

Page 53: Upgrading To 11g

In-Memory Cache In-Memory Cache

Page 54: Upgrading To 11g

In-Memory Database Cache An Oracle Database Option

• Deployed as a read/write cache for Oracle Database

• Transactional SQL processing for cached Application

Telco ServicesFinancial Services

CRM, Portal, SaaS,

Customer-facing Applications

Real-TimeBAM & BI

processing for cached data

• Greatly improve application response time

In-MemoryDatabase

Cache

Application

In-MemoryDatabase

Cache

Application

In-MemoryDatabase

Cache

Application

Page 55: Upgrading To 11g

Automatic Storage Managment Automatic Storage Managment Eliminates need for conventional file system and volume manager

Page 56: Upgrading To 11g

ASM 11g Enhancements Cluster File System (ACFS)

Automatic Storage Management (ASM)

File SystemsApplicationsDatabases

• ASM supports ALL data• Database files

• File systems: ACFS, 3rd-party file systems

• Shared Clusterware files: OCR and Voting disk now stored in ASM

DB Datafiles OCR and Voting Files Oracle Binaries 3rd Party File Systems

Page 57: Upgrading To 11g

Oracle Database 11g Release 2Other ASM Enhancements

• Improved Management

• ASM Install & Configuration Assistant (ASMCA)

• Full Featured ASMCMD

• ASM File Access Control

• ASM Disk Group Rename

Infrequently Accessed

Data

Frequently Accessed

Data

• ASM Disk Group Rename

• Datafile to Disk Mapping

• Tunable Performance

• Intelligent Data Placement

© 2009 Oracle Corporation – Proprietary and Confidential

Page 58: Upgrading To 11g

AgendaOracle 11g Overview• Manageability & Testing

• Real Application Testing

• Grid Computing / High Availability

• Active DG

• Online Application Upgrade

• RAC (New Features)

• Performance / Storage Management

• Advance Compression• Advance Compression

• Partitioning

• In-Memory Cache

• ASM Cluster File System

• Database Security

• Monitoring

• Access Control

• Encryption & Masking

Page 59: Upgrading To 11g

Securing Data in Your Database

• Encryption • Activity Monitoring

Oracle Confidential59

Detection

• Masking

• Classification

• Access Control

• Change Tracking

• Discovery and Assessment

• Secure Configuration

Page 60: Upgrading To 11g

Database Defense-in-Depth

Monitoring

• Configuration Management

• Audit Vault

• Total Recall

Access Control

• Database Vault

Oracle Confidential60

Monitoring

Access Control

Encryption & Masking

• Database Vault

• Label Security

• Advanced Security

• Secure Backup

• Data Masking

Encryption & Masking

Page 61: Upgrading To 11g

Database Defense-in-Depth

Monitoring

• Configuration Management

• Audit Vault

• Total Recall

Access Control

• Database Vault

Oracle Confidential61

Monitoring

Access Control

Encryption & Masking

• Database Vault

• Label Security

• Advanced Security

• Secure Backup

• Data Masking

Encryption & Masking

Page 62: Upgrading To 11g

Encryption and MaskingWhat We Heard From Our Customers…

• “Our PCI auditors say we have to encrypt credit card data whether it is in motion, rest, or storage.”

• “We need to encrypt personal identity information to comply with EU Data Privacy but cannot change our applications.”

• “We want to store medical records in our database but we need to encrypt to comply with CA AB 1298.”

• “We send back-ups off-site and need to make sure they are • “We send back-ups off-site and need to make sure they are secure even if off-site facility is compromised.”

• “We need to protect confidential data in test environments when the data is used by developers or offshore vendors

• “We need to share customer data with 3rd parties without revealing personally identifiable information”

When in Doubt, Encrypt or MaskEncryption / Masking Recognized as Defensible Safeguard

Page 63: Upgrading To 11g

Disk

Backups

Exports

Off-SiteFacilities

Oracle Advanced SecurityTransparent Data Encryption

Application

Facilities

Oracle Confidential63

• Complete encryption for data at rest

• No application changes required

• Efficient encryption of all application data

• Built-in key lifecycle management

Page 64: Upgrading To 11g

Oracle Advanced SecurityNetwork Encryption & Strong

Authentication

Oracle Confidential64

• Standard-based encryption for data in transit

• Strong authentication of users and servers

• No infrastructure changes required

• Easy to implement

Page 65: Upgrading To 11g

DataWritten

DataAutomatically Transparent Transparent

Oracle Advanced Security OptionEncryption and Strong Authentication Services

Network Network EncryptionEncryption

Strong Strong AuthenticationAuthentication

WrittenTo Disk

AutomaticallyEncrypted

AutomaticallyDecryptedThrough

SQL Interface

Transparent Transparent Data EncryptionData Encryption

Transparent Data EncryptionWith RMAN Can Encrypt

Entire Backups Sent to Disk

Page 66: Upgrading To 11g

Oracle Data MaskingWhat is data masking?

What

• The act of anonymizing customer, financial, or company confidential data to create new, legible data which retains the data's properties, such as its width, type, and format.

LAST_NAME SSN SALARY

AGUILAR 203-33-3234 40,000

BENSON 323-22-2943 60,000

D’SOUZA 989-22-2403 80,000

FIORANO 093-44-3823 45,000

Why

• To protect confidential data in test environments when the data is used by developers or offshore vendors

• When customer data is shared with 3rd parties without revealing personally identifiable information

LAST_NAME SSN SALARY

ANSKEKSL 111—23-1111 40,000

BKJHHEIEDK 111-34-1345 60,000

KDDEHLHESA 111-97-2749 80,000

FPENZXIEK 111-49-3849 45,000

Page 67: Upgrading To 11g

Major features

• Automatic database referential integrity when masking primary keys

Enterprise ManagerData Masking Pack

Production Staging

Test

Test

CloneClone

• Automatic database referential integrity when masking primary keys

• Implicit – database enforced

• Explicit – application enforced

• Data mask format library

• View sample data before masking

• Application masking templates

• Define once; execute multiple times

Page 68: Upgrading To 11g

Oracle Data MaskingIrreversible De-Identification

LAST_NAME SSN SALARY

ANSKEKSL111—23-

111160,000

BKJHHEIEDK 222-34-1345 40,000

LAST_NAME SSN SALARY

AGUILAR 203-33-3234 40,000

BENSON 323-22-2943 60,000

Production Non-Production

Oracle Confidential68

• Remove sensitive data from non-production databases

• Referential integrity preserved so applications continue to work

• Sensitive data never leaves the database

• Extensible template library and policies for automation

Page 69: Upgrading To 11g

Database Defense-in-Depth

Monitoring

• Configuration Management

• Audit Vault

• Total Recall

Access Control

• Database Vault

Oracle Confidential69

Monitoring

Access Control

Encryption & Masking

• Database Vault

• Label Security

• Advanced Security

• Secure Backup

• Data Masking

Encryption & Masking

Page 70: Upgrading To 11g

Access ControlWhat we heard from our customers…

• “No user should be able to by-pass our application to access information in the database directly.”

• “How can I restrict access to data on a “need to know” basis in order to protect dat privacy and achieve regulatory compliance?”

• “Legal says our DBA should not be able to read financial records, but the DBA needs to access the database to do her records, but the DBA needs to access the database to do her job. What do we do?”

• “Our SOX auditors require that we separate account creation from granting privileges to accounts.”

• “How do we keep the Finance department from running reports during production hours?”

• “New DBAs should not be able to make database changeswithout a senior DBA being present.”

Page 71: Upgrading To 11g

Oracle Label SecurityData Classification for Access Control

Confidential Sensitive

Transactions

Report Data

Reports

SensitiveSensitive

ConfidentialConfidential

PublicPublic

• Classify users and data based on business drivers

• Database enforced row level access control

• Users classification through Oracle Identity Management Suite

• Classification labels can be factors in other policies

Oracle Confidential71

Confidential Sensitive

Page 72: Upgrading To 11g

Oracle Label Security Row Level Security

Label AuthorizationSensitive : HR : US

employee_org

Select * from employee_org

employee_org

LJ1

LUS3

LUK4

Confidential

Sensitive : HR : US

Sensitive : HR : UK

Page 73: Upgrading To 11g

Oracle Label SecurityPolicy Administration Model

HRHR

PolicyPolicy

Law EnforcementLaw Enforcement

PolicyPolicy

Government Government PolicyPolicy

Confidential

Sensitive

Highly Sensitive

Level 1

Level 2

Level 3

Confidential

Secret

Top Secret

LevelsLevels

PII Data

Investigation

Internal Affairs

Drug Enforcement

Desert Storm

Border Protection

HR REP

Senior HR REP

Local Jurisdiction

FBI

Justice

NATO

Homeland Security

CompartmentsCompartments

GroupsGroups

Page 74: Upgrading To 11g

Oracle Database VaultSeparation of Duties & Privileged User

Controls

Procurement

HR

Finance

Application

select * from finance.customers

DBA

Oracle Confidential74

• DBA separation of duties

• Limit powers of privileged users

• Securely consolidate application data

• No application changes required

select * from finance.customers

Page 75: Upgrading To 11g

• Customer may want to lock down the DB application structure even from the application owner.

• Prevent HR user from changing the

Extend the Separation of Duties to the

application level

DBA

SELECT * FROM HR.EMP

HR RealmDB structure even though he owns these objects.

• Using DV, we can prevent HR App DBA from dropping any table he owns.

HR App DBA

FIN App DBA

HR

HR Realm

FIN

FIN Realm

Disallow Drop Table

Page 76: Upgrading To 11g

Oracle Database VaultMulti-Factor Access Control Policy

Enforcement

Procurement

HR

RebatesApplication

Oracle Confidential76

• Protect application data and prevent application by-pass

• Enforce who, where, when, and how using rules and factors

• Out-of-the box policies for Oracle applications, customizable

Page 77: Upgrading To 11g

Oracle Database Vault DemoTransparent Multi-factor Authorization

HR account

HR

SELECT ….

Unexpected IP address

• DV helps customers implement strict access control security policies

• Access can be restricted by IP address, or subnet, time or application

FIN DBA

FIN

CREATE …

Business hours

time or application interface.

• Using DV, we can prevent the DBA from executing alter system commands from a specific IP address.

Page 78: Upgrading To 11g

Database Defense-in-Depth

Monitoring

• Configuration Management

• Audit Vault

• Total Recall

Access Control

• Database Vault

Oracle Confidential78

Monitoring

Access Control

Encryption & Masking

• Database Vault

• Label Security

• Advanced Security

• Secure Backup

• Data Masking

Encryption & Masking

Page 79: Upgrading To 11g

MonitoringWhat We Heard From Our Customers…

• “How can I monitor all of my database users, especially privilege users to ensure they are not abusing their powers?”

• “I would like to get alerts to flag unauthorized activities making it easy to unauthorized activities making it easy to detect insider threats”

• “I need out-of-the-box reports for activities associated with privileged user activity and access to sensitive data”

Page 80: Upgrading To 11g

Oracle Audit VaultAutomated Activity Monitoring & Audit

Reporting

CRM Data

ERP Data

Databases

HR Data

Audit Data

Policies

Built-inReports

Alerts

CustomReports

!

Auditor

Oracle Confidential

• Consolidate audit data into secure repository

• Detect and alert on suspicious activities

• Out-of-the box compliance reporting

• Centralized audit policy management

Page 81: Upgrading To 11g

Oracle Audit Vault Monitor Database Activity with a Secure Audit Data Warehouse

• Manage Audit Data

• Secure consolidation of audit data from all Oracle databases

• Centrally manage all Oracle database audit settings

• Detect suspicous activities

Monitor EnforceReport Secure

IBM DB2

• Monitor all database users –especially privileged users

• Alert on unauthorized activities

• Simplify compliance reporting

• Built-in compliance reports

• Define custom reportsOracle Database 10g Release 2

Oracle Database 10g Release 1

Oracle Database 9i Release 2

Oracle Database 11g

SQL Server

Sybase

Page 82: Upgrading To 11g

Oracle Total RecallSecure Change Tracking

select salary from emp AS OF TIMESTAMP

'02-MAY-09 12.00 AM‘ where emp.title = ‘admin’

Oracle Confidential82

• Transparently track data changes

• Efficient, tamper-resistant storage of archives

• Real-time access to historical data

• Simplified forensics and error correction

Page 83: Upgrading To 11g

“Well, there wasn't enough time, Michael.

There just wasn't enough time.”

Steve FlournoyOD Solutions Specialist

Page 84: Upgrading To 11g

Not Enough Time to Cover All of the Features For…

ManageabilityAvailability ManageabilityManageabilityAvailabilityAvailability

Oracle ClusterwareOracle Real Application ClustersOracle Secure Backup Oracle Data GuardFlashback OperationsOnline Operations

Diagnostics PackTuning Pack

Change Management PackConfiguration Management Pack

Provisioning Pack

SecuritySecurityStorage ManagementStorage Management

Online Operations

Automatic Storage ManagementAutomatic Space ManagementDisk based Backup/RecoveryCompressionPartitioningExadata Storage

Provisioning Pack

Fine Grained AccessIdentity Management

Transparent Data EncryptionData Masking Pack

Database VaultAudit Vault

Page 85: Upgrading To 11g

And Other 11gR2 Features• Grid Plug and Play!!• Oracle Restart – DB, ASM, Listener after restart of software/hardware• Out of Place Upgrades (zero downtime for patching)• In Memory Parallel Execution & Auto Degree of Parallelism (DOP)• Enterprise Manager for Provisioning, Clusterware, GPnP, Restart• Universal installer (Remove RAC, de-install, downgrades, patches,restarts)• ASM FS (file system) snapshots – 64 images – backup/reco/data mining!• Intelligent data placement on fast tracks• Flashback Data Archive support for DDL• Flashback Data Archive support for DDL• Instance caging – allocate CPU usage to instances (CPU_COUNT)• Compare SQL Tuning sets to each other• Tuning Advisor can use auto DOP, searches historical performance, transport

back to 10gR2 or later for testing.• Virtual Columns can be in PK/FK of reference partition table• Stored outline migration to SQL Plan Management (SPM)• Automatic Block Repair

• Etc..

Page 86: Upgrading To 11g

But Still Time to Remind You HowOracle Can Help You Maximize Your Budget Value

Avoids online revenue losses up to 25%

Cuts configuration management effort by 90%

Replaces manual tools with automation;

Deploys SOA infrastructure 92% faster

Saves 80% time and effort for managing Databases

Improves IT productivity by 25%

Drives asset utilization up by 70%

Saves $1.9 millionwith Oracle Enterprise

Saves $170,000 per year with Oracle

Saves weeks on application testing time

tools with automation; saves time by 50%

Reduces Database testing time by 90%

Reduces provisioning effort by 75%

with Oracle Enterprise Manager

year with Oracle Enterprise Manager

Delivers 24/7 uptime with Oracle Enterprise Manager

Cuts application testing from weeks tohours

Reduces critical patching time by 80%